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AMENDMENTS TO THE CLAIMS 

The following listing of claims will replace all prior versions and listings of claims 
in the application. 

Listing Of Claims 

1. (Currently amended) A method for preventing Transmission Control 
Protocol (TCP) synchronize (SYN) package flood attacks, comprising the steps of: 

(1) a firewall having received a TCP SYN connection request package from a 
client, creating a TCP SYN response package with a zero window size for the client to 
inform the client not to send data packages, and returning to the client by the firewall as 
an agent of a server , i nform i ng th e c lie nt not to s e nd data packag e s by th e TCP SYN 
r e spons e packag e; 

(2) detecting whether having received a TCP SYN acknowledgement 
package from the client, if yes, creating a TCP SYN connection request package for the 
server and sending to the server by the firewall as an agent of the client, otherwise 
discarding the TCP SYN connection request package from the client; 

(3) having received a TCP SYN response package from the server, creating a 
TCP SYN acknowledgement package for the server and returning to the server, 

at same time, creating a TCP SYN acknowledgement package with a non-zero 
window size for the client to inform the client to initiate data transmission and sending to 
the client; 
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, and i n i t i at i ng data transm i ss i on by the TCP SYN acknow le dg e m e nt packag e ; 

(4) forwarding data packages coming from the client to the server by the 
firewall as an agent of the client, and forwarding data packages coming from the server 
to the client by the firewall as an agent of the server. 

2. (Currently amended) The method according to Claim 1, wherein step 1 
further comprising, after having received the TCP SYN connection request package 
from the client, recording source sequence number and window size of the TCP SYN 
connection request package from the client; 

wherein creating a TCP SYN response package for the client further 
comprism§es, creating the TCP SYN response package with a source sequence 
number produced by the firewall, a zero w i ndow siz e , source address being the server 
address and destination address being the client addressj. 

whoro i n i nform i ng tho c li ont not to sond data packages compr i s i ng, bas i ng on tho 
z e ro w i ndow s i z e . 

3. (Previously presented) The method according to Claim 1, wherein step 2 
further comprising, after having received the TCP SYN acknowledgement package from 
the client, recording window size of the TCP SYN acknowledgement package from the 
client; 

wherein creating a TCP SYN connection request package for the server 
comprising, creating the TCP SYN connection request package with source sequence 
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number and window size of the TCP SYN connection request package from the client, 
source address being the client address and destination address being the server 
address. 

4. (Currently amended) The method according to Claim 1 , wherein step 3 of 
further comprising: after having received the TCP SYN response package from the 
server, recording source sequence number and window size of the TCP SYN response 
package from the server; 

wherein creating a TCP SYN acknowledgement package for the server 
compr i s i nq comprises , creating the TCP SYN acknowledgement package for the server 
with window size of the TCP SYN acknowledgement package from the client, 
destination address being the server address and source address being the client 
address; 

wherein creating a TCP SYN acknowledgement package for the client further 
comprismges, creating the TCP SYN acknowledgement package with a non z e ro 
w i ndow s i zo, destination address being the client address and source address being the 
server address^ 

whoro i n i n i t i at i ng data transm i ss i on compr i s i ng, bas i ng on tho non zoro w i ndow 

5. (Previously presented) The method according to Claim 1, wherein 
forwarding data packages coming from the client to the server by the firewall as an 
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agent of the client comprising, keeping source sequence number and window size of 
the data package from the client unchanged, calculating a difference between source 
sequence number of the TCP SYN response package from the server and source 
sequence number of the TCP SYN response package for the client, modifying 
acknowledgement sequence number of the data package from the client by increasing 
the difference, and then sending the modified data package to the server; 

wherein forwarding data packages coming from the server to the client by the 
firewall as an agent of the server comprising, keeping acknowledgement sequence 
number and window size of the data package from the server unchanged, calculating a 
difference between source sequence number of the TCP SYN response package from 
the server and source sequence number of the TCP SYN response package for the 
client, modifying source sequence number of the data package from the server by 
decreasing the difference, and then sending the modified data package to the client. 
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